🕵️ ShinyHunters

The items that name it 26

• Hackers Publish Work Details of 41,000 Homeland Security Employees
  articleas threat actors2026-10-29It is written here as ShinyHunters (cybercrime group that claimed in September to hold 2 to 3 terabytes of data on FBI agents and job applicants).

  cybercrime group that claimed in September to hold 2 to 3 terabytes of data on FBI agents and job applicants

• Over 41,000 DHS Employee Records Leaked Online
  articleas classification.key entities2026-10-29
• Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents
  articleas classification.key entities2026-10-28
• Unwrapping Retail Peak Season Cyber Threats
  articleas classification.key entities2026-10-28
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
  articleas classification.key entities2026-10-23
• Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
  articleas threat actors2026-10-22It is written here as ShinyHunters: Google warns of a fresh Oracle PeopleSoft campaign (mentioned only in a related-article link).

  mentioned only in a related-article link

• The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
  articleas threat actors2026-10-15It is written here as ShinyHunters (attack on the FBI's IT systems exposed personal data about thousands of bureau employees, per CyberScoop).

  attack on the FBI's IT systems exposed personal data about thousands of bureau employees, per CyberScoop

• Have I Been Pwned (@haveibeenpwned) on X
  threadas classification.key entities2026-10-12
• Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
  articleas classification.key entities2026-10-12
• ASOS Confirms Cyberattack, Data Breach
  articleas threat actors2026-10-07

  In 2024, hacked Snowflake instances of over 160 organizations and stole sensitive data used for extortion, using credentials obtained from infostealers for initial access; cited by Forescout Research – Vedere Labs as a possibly similar precedent to the ASOS incident, though not confirmed

• The OpenSourceMalware Show #23
  talkas threat actors2026-10-02

  Hacking group; member Pepijn van der Stap (handle Umbreon), Dutch, age 24, arrested September 16 after previously serving part of a 3-year prison sentence; formerly worked at Hadrian and more recently at Neo as an offensive security researcher. Power struggle reported with a 16-year-old Jordanian le

• FBI Tells Its Employees to Assume Hackers Have Their Personal Data
  articleas threat actors2026-09-30

  Cybercrime crew claiming breach of FBIjobs.gov; claims 2 to 3 terabytes of data on FBI agents, job applicants, and some spouses; surfaced in 2020 selling stolen databases on hacker forums; helped run BreachForums; claimed about 1.5 billion records from Salesforce customers last year; denies FBI's ha

• Check Point Research — 28th September Threat Intelligence Report
  articleas threat actors2026-09-28

  Group that defaced FBIjobs.gov, claimed to have stolen employee and applicant information, and shared samples of purported FBI personnel records with media organizations.

• ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
  writeupas classification.key entities2026-09-25
• The OpenSourceMalware Show #22
  talkas threat actors2026-09-25

  Threat actor group claiming to have hacked an FBI jobs website via a PeopleSoft zero-day; threatening to leak stolen data unless the FBI retracts a May FLASH advisory tied to the Instructure Canvas breach; also engaged in a public feud with ransomware crew Cl0p, including compromising a Cl0p website

• Trust and the enticing consultancy offer
  articleas threat actors2026-09-24

  Claims to have breached multiple FBI-related services and stolen data on all FBI employees and applicants, including names, home addresses, phone numbers, and spouse information.

• Passkey-themed social engineering leads to identity and cloud compromise
  writeupas threat actors2026-09-09

  Extortion group to which Storm-3121 initial access activity leads.

• [tl;dr sec] #344 - VMs won't contain Cyber-capable Agents, AWS AI Security Analyst, Decompilers vs LLMs
  articleas threat actors2026-09-08

  Claimed the Carhartt breach; Troy Hunt found nearly half of the 24.8M email addresses were synthetic TPC-DS benchmark data and the actual victim count was 12.9M.

• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
  articleas classification.key entities2026-09-08
• The OpenSourceMalware Show #19
  talkas classification.key entities2026-08-28
• Education Under Attack: The Pattern Behind Recent University Breaches
  articleas threat actors2026-08-13

  Extortion group that breached Instructure's Canvas platform claiming 275 million records and later defaced Canvas login portals at hundreds of institutions, timed to land during finals week; 90 days after that, exploited an unpatched remote-code-execution flaw in Oracle PeopleSoft, reaching more tha

• OpenSourceMalware Blog
  articleas threat actors2026-07-18

  Threat actor group; attacked FBI and ransomed Canvas.

• Full Fathom Five: The context of Anthropic’s Mythos-class public release
  articleas threat actors2026-06-13It is written here as Shiny Hunters (named as example of attackers, bored teenagers).

  named as example of attackers, bored teenagers

• Open Source Malware Podcast — episodes
  otheras threat actors2026-05-22

  Attacked FBI jobs website (alleged PeopleSoft zero-day data theft, threatening leak unless FBI retracts a May report); also ransomed Canvas

• Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks
  articleas threat actors2026-05-20

  Group with reporting pointing to overlapping claims alongside Vect and Lapsus$ in the same credential-theft pipeline, making attribution messy

• Detecting and countering misuse of AI: September 2026
  articleas threat actorsIt is written here as ShinyHunters (collective known for large-scale data theft followed by pay-or-leak extortion).

  collective known for large-scale data theft followed by pay-or-leak extortion